fix: validate release keys and smoke-run the genesis build on PRs - #254
Open
mordamax wants to merge 3 commits into
Open
fix: validate release keys and smoke-run the genesis build on PRs#254mordamax wants to merge 3 commits into
mordamax wants to merge 3 commits into
Conversation
Contributor
CI Summary
Deploy ContractsDeployed addresses vs the committed manifestExpected is the committed manifest; actual is this CI deployment of the same pipeline.
Labelsother |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
v0.5.6-rc1's genesis step died on
cast's bareFailed to decode private key— the first time anything ever consumed theDOTNS_ADMIN_KEYsecret was on master, because PR CI ran onlybash -nand the extractor's unit tests, never the script.Two changes:
DOTNS_ADMIN_KEYis now the only accepted owner key — the mnemonic fallback is gone (two credentials make the build guess which account owns everything, and the parity check validates addresses, not owners). A preflight rejects a malformed key before anvil starts and reports its shape — length, word count, a mnemonic hint with thecast wallet private-keyderivation command — never the value, since a GitHub secret cannot be read back. Surrounding whitespace is stripped: a pasted trailing newline is the classic break, verified end to end.genesis-build-smoke.ymlruns the exact release command with the real secrets on every PR touching contracts, deploy or genesis scripts, manifests, or the publish workflows — same-repo PRs only, parity unstubbed, artifact shape asserted and uploaded.The smoke run on this PR doubles as the probe for the broken secret: expect it red, read the shape from its log, re-paste the secret, re-run. Then re-dispatch the failed
Publish Beta Packagefor v0.5.6-rc1.Type
Scope
Related Issues
Follow-up to #253.
Fixes
Checklist
Code
forge buildpassesforge testpassesTesting
Security
selfdestructordelegatecallDocumentation
Breaking Changes
How to test
Exercised locally: all four malformed shapes fail fast without leaking the value; a newline-suffixed key completes the full build (33 accounts).
Notes
No Solidity changed; the contract checkboxes are inherited state.